fix: Perform validations on file path operations

Signed-off-by: jay-dee7 <[email protected]>

dfs/mock/memMappedSystem.go

@@ -75,6 +75,10 @@ func (ms *memMappedMockStorage) UploadPart(
 	content io.ReadSeeker,
 	contentLength int64,
 ) (s3types.CompletedPart, error) {
+	if err := ms.validateLayerKey(layerKey); err != nil {
+		return s3types.CompletedPart{}, err
+	}
+
 	fd, err := ms.memFs.OpenFile(layerKey, os.O_RDWR|os.O_CREATE, os.ModePerm)
 	if err != nil {
 		return s3types.CompletedPart{}, err
@@ -108,6 +112,10 @@ func (ms *memMappedMockStorage) CompleteMultipartUpload(
 }
 
 func (ms *memMappedMockStorage) Upload(ctx context.Context, identifier, digest string, content []byte) (string, error) {
+	if err := ms.validateLayerKey(identifier); err != nil {
+		return "", err
+	}
+
 	fd, err := ms.memFs.Create(identifier)
 	if err != nil {
 		return "", err
@@ -178,7 +186,23 @@ func (ms *memMappedMockStorage) Metadata(layer *types.ContainerImageLayer) (*typ
 	}, nil
 }
 
+func (ms *memMappedMockStorage) validateLayerKey(identifier string) error {
+	if len(identifier) <= LayerKeyPrefixLen || identifier[0:LayerKeyPrefixLen] != LayerKeyPrefix {
+		return fmt.Errorf(
+			"invalid layer prefix. Found: %s, expected: %s",
+			identifier[0:LayerKeyPrefixLen],
+			LayerKeyPrefix,
+		)
+	}
+
+	return nil
+}
+
 func (ms *memMappedMockStorage) GetUploadProgress(identifier, uploadID string) (*types.ObjectMetadata, error) {
+	if err := ms.validateLayerKey(identifier); err != nil {
+		return nil, err
+	}
+
 	fd, err := ms.memFs.Open(identifier)
 	if err != nil {
 		return nil, err
@@ -209,6 +233,10 @@ func (ms *memMappedMockStorage) GeneratePresignedURL(ctx context.Context, key st
 }
 
 func (ms *memMappedMockStorage) AbortMultipartUpload(ctx context.Context, layerKey string, uploadId string) error {
+	if err := ms.validateLayerKey(layerKey); err != nil {
+		return err
+	}
+
 	if err := ms.memFs.Remove(layerKey); err != nil {
 		return err
 	}
@@ -228,6 +256,11 @@ func (ms *memMappedMockStorage) FileServer() {
 
 	e.Add(http.MethodGet, "/:uuid", func(ctx echo.Context) error {
 		fileID := ctx.Param("uuid")
+		if err := ms.validateLayerKey(fileID); err != nil {
+			return ctx.JSON(http.StatusBadRequest, echo.Map{
+				"error": err.Error(),
+			})
+		}
 		fd, err := ms.memFs.Open(fileID)
 		if err != nil {
 			return ctx.JSON(http.StatusBadRequest, echo.Map{

dfs/mock/mock.go

@@ -1,10 +1,11 @@
 package mock
 
 import (
+	"github.com/fatih/color"
+
 	"github.com/containerish/OpenRegistry/config"
 	"github.com/containerish/OpenRegistry/dfs"
 	"github.com/containerish/OpenRegistry/telemetry"
-	"github.com/fatih/color"
 )
 
 func NewMockStorage(
@@ -27,6 +28,7 @@ func NewMockStorage(
 }
 
 const (
-	MockFSPath     = ".mock-fs"
-	LayerKeyPrefix = "layers"
+	MockFSPath        = ".mock-fs"
+	LayerKeyPrefix    = "layers"
+	LayerKeyPrefixLen = len(LayerKeyPrefix) // to account for trailing slash
 )

dfs/mock/mockFileSystem.go

@@ -52,7 +52,7 @@ func newFileBasedMockStorage(
 	_ = os.MkdirAll(MockFSPath, os.ModePerm)
 	_ = os.MkdirAll(fmt.Sprintf("%s/%s", MockFSPath, LayerKeyPrefix), os.ModePerm)
 	mocker := &fileBasedMockStorage{
-		fs:              afero.NewBasePathFs(afero.NewOsFs(), ".mock-fs"),
+		fs:              afero.NewBasePathFs(afero.NewOsFs(), MockFSPath),
 		uploadSession:   make(map[string]string),
 		config:          cfg,
 		serviceEndpoint: net.JoinHostPort(parsedHost.Hostname(), "5002"),
@@ -87,6 +87,10 @@ func (ms *fileBasedMockStorage) UploadPart(
 	content io.ReadSeeker,
 	contentLength int64,
 ) (s3types.CompletedPart, error) {
+	if err := ms.validateLayerKey(layerKey); err != nil {
+		return s3types.CompletedPart{}, err
+	}
+
 	fd, err := ms.fs.OpenFile(layerKey, os.O_RDWR|os.O_CREATE, os.ModePerm)
 	if err != nil {
 		return s3types.CompletedPart{}, err
@@ -120,7 +124,22 @@ func (ms *fileBasedMockStorage) CompleteMultipartUpload(
 	return layerKey, nil
 }
 
+func (ms *fileBasedMockStorage) validateLayerKey(identifier string) error {
+	if len(identifier) <= LayerKeyPrefixLen || identifier[0:LayerKeyPrefixLen] != LayerKeyPrefix {
+		return fmt.Errorf(
+			"invalid layer prefix. Found: %s, expected: %s",
+			identifier[0:LayerKeyPrefixLen],
+			LayerKeyPrefix,
+		)
+	}
+
+	return nil
+}
+
 func (ms *fileBasedMockStorage) Upload(ctx context.Context, identifier, digest string, content []byte) (string, error) {
+	if err := ms.validateLayerKey(identifier); err != nil {
+		return "", err
+	}
 	if err := ms.validateLayerPath(identifier); err != nil {
 		return "", err
 	}
@@ -195,6 +214,10 @@ func (ms *fileBasedMockStorage) Metadata(layer *types.ContainerImageLayer) (*typ
 }
 
 func (ms *fileBasedMockStorage) GetUploadProgress(identifier, uploadID string) (*types.ObjectMetadata, error) {
+	if err := ms.validateLayerKey(identifier); err != nil {
+		return nil, err
+	}
+
 	fd, err := ms.fs.Open(identifier)
 	if err != nil {
 		return nil, err

main.go

@@ -7,10 +7,11 @@ import (
 	"os"
 	"strings"
 
+	"github.com/urfave/cli/v2"
+
 	"github.com/containerish/OpenRegistry/cmd/extras"
 	"github.com/containerish/OpenRegistry/cmd/migrations"
 	"github.com/containerish/OpenRegistry/cmd/registry"
-	"github.com/urfave/cli/v2"
 )
 
 var (

registry/v2/registry.go

@@ -112,15 +112,15 @@ func (r *registry) Catalog(ctx echo.Context) error {
 	var pageSize int
 	var offset int
 	if queryParamPageSize != "" {
-		ps, err := strconv.ParseInt(ctx.QueryParam("n"), 10, 64)
+		ps, err := strconv.Atoi(ctx.QueryParam("n"))
 		if err != nil {
 			echoErr := ctx.JSON(http.StatusBadRequest, echo.Map{
 				"error": err.Error(),
 			})
 			r.logger.Log(ctx, err).Send()
 			return echoErr
 		}
-		pageSize = int(ps)
+		pageSize = ps
 	}
 
 	if queryParamOffset != "" {

telemetry/log.go

@@ -7,11 +7,12 @@ import (
 	"time"
 
 	"github.com/axiomhq/axiom-go/axiom"
-	"github.com/containerish/OpenRegistry/config"
-	"github.com/containerish/OpenRegistry/types"
 	"github.com/fatih/color"
 	"github.com/labstack/echo/v4"
 	"github.com/rs/zerolog"
+
+	"github.com/containerish/OpenRegistry/config"
+	"github.com/containerish/OpenRegistry/types"
 )
 
 type Logger interface {
@@ -55,6 +56,9 @@ func setupLogger(config config.Logging) zerolog.Logger {
 		TimeFormat: time.RFC3339,
 	}
 
+	if !config.Enabled {
+		return zerolog.Nop()
+	}
 	l = l.Output(consoleWriter)
 
 	if config.RemoteForwarding {